For XRootD, we decided that the "time" the session token should be evaluated should be when the session starts and not when the operation is attempted; this allows session authorizations to live longer than the token (this matches how X.509 works -- expiration time is only checked at start).
Hence, at the SciTokens library level we must allow the user to explicitly set the clock backward for token evaluation.
Implementation is rather straightforward - unit test is included.
For XRootD, we decided that the "time" the session token should be evaluated should be when the session starts and not when the operation is attempted; this allows session authorizations to live longer than the token (this matches how X.509 works -- expiration time is only checked at start).
Hence, at the SciTokens library level we must allow the user to explicitly set the clock backward for token evaluation.
Implementation is rather straightforward - unit test is included.